# The Beneficial Ownership Intake the Commercial Bank Still Has to Run: CDD Rule 1010.230, CTA/BOI After the March 2025 Interim Rule, and Where the AI Agent Sits

*July 3, 2026 · 13 min read · Ramkumar Venkataraman*

> The Corporate Transparency Act's beneficial ownership filing regime has been through two injunctions, a Supreme Court stay, and a March 2025 FinCEN interim final rule that exempted domestic reporting companies. What has not changed is the bank's independent Customer Due Diligence rule at 31 CFR 1010.230, which requires beneficial-ownership collection at legal-entity account opening under the same 25 percent and substantial-control tests. The intake architecture we run on the commercial-banking desk while the two regimes remain unaligned.

## The Regime That Has Not Settled and the Regime That Never Moved

The [Corporate Transparency Act's beneficial ownership information reporting rule at 31 CFR 1010.380](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-C/section-1010.380) has had one of the most fractured implementation histories of any Bank Secrecy Act rule. The rule was final in September 2022, effective January 1, 2024, and produced enforcement-deferral notices, a preliminary injunction from the Northern District of Alabama in [NSBA v. Yellen](https://storage.courtlistener.com/recap/gov.uscourts.alnd.180749/gov.uscourts.alnd.180749.51.0.pdf) in March 2024, a nationwide preliminary injunction from the Eastern District of Texas in [Texas Top Cop Shop v. Garland](https://storage.courtlistener.com/recap/gov.uscourts.txed.229472/gov.uscourts.txed.229472.30.0.pdf) in December 2024, a Supreme Court stay of that injunction in January 2025, and FinCEN's [interim final rule of March 21, 2025](https://www.fincen.gov/news/news-releases/fincen-removes-beneficial-ownership-reporting-requirements-us-companies-and-us) that exempted domestic reporting companies and US persons from the filing obligation, leaving only foreign reporting companies subject to the BOI reporting rule as of the interim rule's effective date.

The consequence for commercial banks is not that the beneficial-ownership question went away. The [Customer Due Diligence Rule at 31 CFR 1010.230](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-C/section-1010.230) has been in place since 2016 and requires covered financial institutions to identify and verify the beneficial owners of legal entity customers at account opening. The CDD Rule and the CTA/BOI rule use similar definitions of beneficial ownership, share the 25 percent ownership threshold and the substantial-control test, and are supposed to be reconciled as part of FinCEN's promised update to the CDD Rule. That reconciliation has not been finalized. The bank's CDD Rule obligation runs regardless of what happened to the BOI filing regime, and the AI commercial-banking agent's intake still has to collect the same information, structured against the same tests, with the same verification and record-keeping requirements the CDD Rule specifies.

We build the agent that handles commercial and business-banking account-opening intake on bank platforms. The architecture below is the one that runs the CDD-Rule collection cleanly in the current environment, that will produce a clean reconciliation with whatever the CDD-Rule update finally looks like, and that positions the bank to file BOI reports for its foreign reporting-company customers if the bank operates that service.

## What 31 CFR 1010.230 Actually Asks the Bank to Collect

The CDD Rule at 1010.230 requires covered financial institutions to identify and verify the identity of the beneficial owners of legal entity customers other than exempted ones at the time a new account is opened. "Legal entity customer" is defined at 1010.230(e) as a corporation, limited liability company, or other similar entity created by filing with a secretary of state, and includes partnerships and general partnerships in the FinCEN commentary. The verified beneficial ownership information includes the name, date of birth, address, and unique identifying number (typically SSN for US persons, passport number for non-US persons).

The two tests that identify beneficial owners are the ownership prong at 1010.230(d)(1) and the control prong at 1010.230(d)(2). The ownership prong identifies each individual who directly or indirectly owns 25 percent or more of the equity interests of the legal entity, up to a maximum of four individuals. The control prong identifies one individual with significant responsibility to control, manage, or direct the legal entity (a CEO, CFO, COO, managing member, general partner, president, vice president, or treasurer, or any other individual who regularly performs similar functions).

The tests can produce zero to four individuals under the ownership prong and always exactly one under the control prong, and the same individual can appear under both prongs. The bank has to identify at least one individual (the control-prong individual) and up to five (the four ownership-prong individuals plus the control-prong individual if different from all four). The intake has to be structured to capture the ownership chain accurately when the ownership involves other legal entities, and the intake has to know when the entity is exempt from the beneficial-ownership collection under the rule's exemptions.

The exemptions at 1010.230(e)(2) include entities that are publicly traded, banks, credit unions, bank holding companies, registered broker-dealers, registered investment companies, registered investment advisers, state-regulated insurers, and other regulated entity types. An exempt entity does not require beneficial-ownership collection under the CDD Rule, though the bank still runs Customer Identification Program verification on the entity itself under [31 CFR 1020.220](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1020/subpart-B/section-1020.220).

## The Ownership Chain Problem the Intake Has to Model

The ownership-prong analysis is straightforward when the legal entity is owned directly by individuals. It gets complex quickly when the ownership involves layers of other entities, trusts, partnerships, or foreign structures. A legal entity owned 40 percent by an LLC that is owned 60 percent by a partnership that has three individual partners each owning 33 percent has an ownership chain that requires "looking through" the intermediate entities to identify the ultimate individual beneficial owners.

The rule's approach at 1010.230(d)(1) is that the 25-percent threshold is applied to the ultimate individual owner's effective interest in the legal entity customer, computed by multiplying the ownership percentages along the chain. In the example above, the three partners each hold 40 percent times 60 percent times 33 percent equals approximately 7.9 percent of the legal entity customer, which is below the 25-percent threshold. No individual beneficial owner is identified under the ownership prong in that example, and only the control-prong individual is collected.

The intake has to model the ownership chain accurately, apply the multiplication correctly, and identify the individuals whose effective percentage crosses 25. Modeling errors in the chain produce beneficial-ownership determinations that are wrong, and the bank's CIP file for the legal entity customer will not accurately reflect the ownership. The examiner's review of a sample of the bank's legal-entity CIP files will find the modeling error if the chain was captured wrong or the arithmetic was applied wrong.

The agent's intake structures the ownership chain as a graph, with nodes for entities and individuals and edges for ownership percentages, and computes the effective percentage of each individual in the tree using standard chain-multiplication. The graph is displayed back to the customer during intake so the customer can confirm the structure, and the graph is stored in the CIP file so the examiner can reproduce the beneficial-ownership determination from the recorded chain. A bank that stores only the final beneficial-ownership list without the chain that produced it is a bank whose examiner will not be able to verify the determination from the file.

## The Verification Standard Beyond Collection

The CDD Rule requires the bank to verify the identity of the beneficial owners through documentary or nondocumentary methods "using the elements from the bank's CIP." The documentary verification typically involves government-issued identification (driver's license, passport), and the nondocumentary methods involve identity verification services and independent-source data comparisons. The verification standard is the CIP standard, which the bank already runs for the individual customer intake, and the CDD Rule's contribution is to extend the CIP verification to the beneficial owners of the legal entity customer.

The verification step is where the friction in commercial account opening sits. A customer opening an account for a legal entity has to produce identification for up to five individuals, some of whom may not be present at the account opening and may not be readily available to the customer opening the account. The traditional in-branch account opening handles this with paper forms, follow-up appointments, and often extended timelines to complete the CIP file.

The AI agent's contribution is to make the verification asynchronous. The account opening at the customer's convenience captures the ownership structure and the beneficial-owner list, generates secure links for each beneficial owner to submit their identification and verification information directly, and tracks the completion of the CIP file per beneficial owner. The account can be opened with initial CIP completion for the primary customer and the control-prong individual, with the ownership-prong beneficial owners' CIP completed within the CDD Rule's expected verification window (which the rule does not tightly specify but which the bank's policies typically limit to 30 to 60 days from account opening).

The tracking of each beneficial owner's CIP completion is a distinct control the agent produces. The examiner's review will look at the population of legal-entity customers and check whether the CIP file is complete for the beneficial owners the ownership structure identified, and a bank whose CIP files are incomplete on a meaningful fraction of legal-entity customers is a bank with a CDD Rule finding. The agent's tracking, follow-up, and escalation to the branch team for the incomplete files is the operational discipline that keeps the population's completeness at the level the examiner expects.

## The 30-Day Update Trigger the CDD Rule Does Not Explicitly Contain

The CDD Rule does not explicitly require ongoing updates to beneficial-ownership information after account opening, other than the general expectation that the bank's customer-due-diligence program will maintain and update customer information appropriately as part of ongoing monitoring. FinCEN's 2020 [Statement on Enforcement of the BSA/AML Requirements](https://www.fincen.gov/news/news-releases/statement-fincen-issues-updated-notice-customers-financial-institutions) clarified that ongoing updates are triggered when the bank has reason to believe that beneficial-ownership information has changed, such as through the ongoing monitoring of the customer relationship.

The CTA/BOI rule, by contrast, requires reporting companies to file updated BOI reports within 30 days of a change to reported information under 1010.380(a)(2). The two regimes' different update requirements create a coordination problem at the bank if the bank is filing BOI reports on behalf of foreign reporting-company customers while also maintaining CDD Rule records on the same customers. The bank's system has to know which update requirements apply to which customer, and the agent's intake has to capture the customer's regime status at account opening.

The intake we run classifies each legal-entity customer against the CTA regime status: exempt from BOI reporting (all domestic reporting companies as of the March 2025 interim rule, plus the CTA's original 23 categories of exempt entities), covered by BOI reporting (foreign reporting companies registered to do business in a US state), or in an ambiguous status pending regime updates. The classification is stored with the customer's file, and the update workflow the agent runs is tailored to the classification. A domestic reporting company gets CDD Rule ongoing monitoring triggered by relationship signals; a foreign reporting company additionally gets a 30-day update workflow triggered by any change to BOI-reportable information.

## The BOSS Filing Layer When the Bank Runs It

Some commercial banks offer BOI filing services to their business customers as a value-added service, filing the customer's BOI report to FinCEN's [Beneficial Ownership Secure System](https://boiefiling.fincen.gov/) on the customer's behalf. Under the March 2025 interim rule, this service applies primarily to foreign reporting-company customers, and the market for the service is significantly smaller than it was under the pre-interim-rule regime.

For banks that operate the service, the filing layer has to interact with FinCEN's BOSS API, has to produce the report in the format BOSS accepts, has to file within the filing windows (30 days from formation for a new reporting company, or 30 days from a change to reported information for an update), and has to maintain the filing record for the customer's compliance file. The bank's authorization to file on the customer's behalf is documented in the service agreement, and the customer's ongoing responsibility for the accuracy of the reported information is preserved (the CTA holds the reporting company and its beneficial owners liable for willful failures to report, not the third-party filer).

The agent's role in the BOSS filing layer is to produce the report content from the CDD Rule data the bank already collected, to reconcile the CDD Rule's data model with BOSS's specific field requirements, and to submit through BOSS with the customer's authorization. The reconciliation matters because the two regimes' data models overlap but do not fully coincide: BOSS requires FinCEN Identifiers for beneficial owners as an alternative to individual identification data, requires company applicant information for entities formed on or after January 1, 2024, and structures the ownership information differently than the bank's CDD Rule file typically does. The agent's transformation of the CDD Rule data into the BOSS filing structure is a specific control the bank's compliance team reviews and signs off on before submission.

## The FinCEN ID and the Individual-Level Identity Layer

The CTA/BOI regime introduced the FinCEN Identifier at 1010.380(b)(4), a unique identifier that an individual can request from FinCEN by submitting their identification information once. The identifier can then be provided to reporting companies in lieu of the individual's specific personal information for each BOI filing. The purpose is to reduce the friction of BOI filings across multiple companies for individuals who are beneficial owners of many entities.

The FinCEN Identifier does not have a direct analog in the CDD Rule; the CDD Rule requires the actual identification information at the bank's file level, and a FinCEN Identifier does not satisfy the CDD Rule's verification standard because the bank has not independently verified the individual's identity. But the FinCEN Identifier is a signal the bank can use in ongoing monitoring: an individual who is a beneficial owner across multiple accounts at the bank can be linked across accounts through the FinCEN Identifier, and the bank's aggregate monitoring of that individual's presence in its customer base becomes a distinct control.

The intake captures the FinCEN Identifier when the customer provides it, links it to the beneficial-owner record in the customer's file, and uses the linkage for cross-account monitoring where the bank's program applies aggregate-level controls. The intake does not treat the FinCEN Identifier as a substitute for the CDD Rule's identification and verification; the CDD Rule's specific requirements have to be met independently, and the FinCEN Identifier is an additional data point rather than a shortcut.

## The Interaction With CIP and the Section 314 Programs

The CDD Rule beneficial-ownership collection is one layer of a broader BSA program that includes the [Customer Identification Program at 31 CFR 1020.220](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1020/subpart-B/section-1020.220) for the customer entity itself, the [Section 314(a) information-sharing program with law enforcement](https://www.fincen.gov/resources/statutes-regulations/section-314a-fact-sheet), the [Section 314(b) information-sharing among financial institutions](https://www.fincen.gov/section-314b-program), the ongoing monitoring for suspicious activity, and the SAR filing program.

The agent's intake for a legal-entity customer runs the CIP verification for the entity, the CDD Rule beneficial-ownership collection for the individuals, and the initial risk classification that feeds ongoing monitoring. The Section 314(a) and (b) programs interact with the customer's account through the monitoring layer, with the beneficial-ownership information feeding both the individual-level and the entity-level matches. The SAR filing that eventually may result from monitoring runs through the [BSA/AML architecture we described separately](/blog/ai-agents-bsa-aml-sar-narratives-transaction-monitoring).

The examiner's review of the bank's BSA program is unified across these components. A bank whose CDD Rule beneficial-ownership file is accurate and current is a bank whose ongoing monitoring is running on the right data. A bank whose CDD Rule file is incomplete or outdated is a bank whose monitoring is running on a data foundation the examiner will find weaker than the bank's monitoring metrics represent. The intake is the foundation, and the foundation's quality shows through in every downstream control.

## The Foreign Reporting Company Segment That Now Carries the BOI Regime

The March 2025 interim final rule's practical effect is that the BOI reporting regime now covers a narrow segment: foreign reporting companies registered to do business in a US state. The commercial-banking customers who fall in this segment are typically US subsidiaries or branches of foreign parents, foreign companies with US operational activities, and specialized structures involving foreign entities with US presence.

The intake distinguishes foreign reporting companies from domestic ones at account opening, and the customer's regime status is stored in the CIP file for downstream use. The bank's BOI-filing service, if operated, is offered to this segment; the CDD Rule collection runs for both segments identically; and the aggregate monitoring across segments applies the appropriate risk classifications to each segment's specific risk profile. A foreign reporting company with US operations is a higher-risk customer profile in most bank programs than a domestic small business, and the bank's monitoring calibration reflects the segment.

We wrote separately on [OFAC sanctions screening](/blog/ofac-sanctions-screening-ai-agents-50-percent-rule) that applies to every customer including foreign reporting companies with additional attention to their foreign ownership structure, and on the [BSA/AML SAR-narrative process](/blog/ai-agents-bsa-aml-sar-narratives-transaction-monitoring) that runs the suspicious-activity reporting layer. The foreign reporting company segment sits at the intersection of these programs and the CDD Rule / BOI intake, and the agent's coordination across the programs is the bank's operational advantage.

## The Data-Handling and Privacy Line the Intake Crosses

The beneficial-ownership information the bank collects and stores is nonpublic personal information about the beneficial owners, and the bank's handling of the information is governed by the [Gramm-Leach-Bliley Safeguards Rule](/blog/glba-safeguards-rule-ai-vendors-banks-non-banks). The safeguards apply to the individual identification and verification information the bank collects (SSN, date of birth, address, government-issued identification), and the storage, access, and disposal of the information have to meet the Safeguards Rule's controls.

The agent's collection of the information runs on encrypted channels, stores the information in the bank's compliant data stores with role-based access, and produces an audit trail of who accessed the information and when. The retention of the information is governed by the CDD Rule's five-year retention requirement (from 1010.230(g)) plus any longer state-law retention requirements the bank's program applies. The disposal of the information at the end of retention runs through the bank's records-management program with the disposal event logged for the examiner's ability to reconstruct the retention lifecycle.

The privacy notices to the beneficial owners at collection describe the specific use of their information, the bank's retention of the information, and the beneficial owners' rights under GLBA and applicable state privacy laws. The notices are individualized to the beneficial owner rather than folded into the customer's general privacy notice, because the beneficial owner is a distinct party from the legal-entity customer whose account is being opened.

## The Failure Mode We Engineer Against

The pattern we consistently see on the commercial-banking desk is a CDD Rule intake process that is designed for the in-branch, high-touch relationship-manager model of ten years ago, layered with digital account-opening tools that partially automate the primary customer intake but that do not extend cleanly to the beneficial-ownership collection. The customer completes the primary account application digitally, and the beneficial-ownership collection falls to a relationship manager who chases down documents and identification for the beneficial owners over weeks. The account opens with a provisional CDD file; the file completes weeks later; and the bank's examiner review of the population finds a meaningful fraction of legal-entity customers whose CDD files remain incomplete.

The architecture we run engineers against this by treating the beneficial-ownership collection as a first-class part of the intake, with the ownership chain modeled at the account-opening moment, the beneficial owners' verification links generated at that moment, and the tracking of each beneficial owner's completion running through the agent's workflow rather than through a human's manual follow-up. The CDD file completes in days rather than weeks in the population, and the fraction of legal-entity customers whose CDD file remains incomplete drops to near zero.

The cost of the change is that the account-opening conversation is longer for legal-entity customers than it would be otherwise, because the ownership chain is captured accurately at the moment the customer is available to provide it. The savings are in the population-level exam posture, in the ongoing-monitoring foundation's quality, and in the ability to serve the customer's future needs (adding a beneficial owner, changing the ownership structure, providing FinCEN identifiers) from a clean initial file.

## The Honest Read

The Corporate Transparency Act's implementation has been chaotic, but the operational question for a commercial bank has been stable throughout. The CDD Rule at 1010.230 requires beneficial-ownership collection at legal-entity account opening under a specific ownership and control framework, the collection is a foundation the bank's monitoring depends on, and the collection has to run cleanly whether or not the CTA/BOI reporting regime applies to a specific customer. The AI agent on the commercial-banking intake is the layer that keeps the CDD Rule intake accurate, current, and complete across the customer population, and the bank whose intake operates this way is the bank whose BSA program's foundation is solid regardless of what the CTA regime looks like in the next six months.

The CDD Rule reconciliation with the CTA that FinCEN has promised is likely to update the CDD Rule to align its definitions and its update-triggering events more closely with the BOI regime. The bank whose CDD data model is captured with the ownership chain, the beneficial-owner records, and the regime classification stored explicitly is a bank that can adapt to the reconciliation's specifics without a data-migration event. The bank whose data model captures only the final beneficial-owner list without the chain, or that stores the regime classification implicitly rather than explicitly, is a bank whose reconciliation will be a system-rebuild rather than a configuration update.

We have written separately on the [BSA/AML SAR-narrative architecture](/blog/ai-agents-bsa-aml-sar-narratives-transaction-monitoring) that runs alongside CDD, on the [OFAC sanctions screening](/blog/ofac-sanctions-screening-ai-agents-50-percent-rule) that applies to every legal entity and every beneficial owner, on the [GLBA Safeguards Rule](/blog/glba-safeguards-rule-ai-vendors-banks-non-banks) that governs the storage of the collected information, and on the [UCC Article 4A wire-verification architecture](/blog/ucc-article-4a-wire-fraud-ai-verification-commercially-reasonable) that runs the transaction-side of the same commercial customer's relationship. The CDD Rule intake is the identity foundation the rest of the programs run on, and the agent's operation of the intake is the bank's operational advantage for keeping the foundation clean.

---

_Source: [https://www.seiright.com/blog/fincen-boi-cdd-corporate-transparency-act-ai-commercial-banking](https://www.seiright.com/blog/fincen-boi-cdd-corporate-transparency-act-ai-commercial-banking) · Sei AI_